Category: *Post Types

Security and compliance teams managing modern cloud environments often ask us: “How do we enforce encryption in transit across every network path? Can we put in place policies that restrict teams from sending unencrypted traffic between any two nodes?”. Your environment likely includes a mixed fleet of Amazon Elastic Compute Cloud (Amazon EC2) instances across […]

As organizations embrace multicloud strategies at an accelerating pace, the ability to move workloads seamlessly between cloud providers has become essential. Yet establishing resilient, high-performance private connectivity between clouds has historically required customers to navigate complex and diverse physical infrastructure, multiple connectivity providers, and invest weeks or months of manual provisioning. Starting today, customers can […]

Introduction Building a multi-region active-active architecture with Amazon CloudFront requires careful coordination of traffic routing to address performance, traffic management, and session consistency requirements, along with automated failover to maintain availability during regional events. In November 2024, AWS released Amazon CloudFront VPC origins, which provides direct connectivity to private resources within your Amazon VPC without […]

CloudFront Functions (CF2) lets you run lightweight code inside Amazon CloudFront Points-of-Presences (POPs) to analyze and manipulate viewer requests and responses at scale. Until now, gaining visibility into the decisions your functions made such as the result of a token validation or logging a header returned from origin required collecting the header from CloudFront Realtime […]

When your user experiences a connectivity issue visiting your website, it’s unlikely that you’ll see a trace of it in your server logs. DNS resolution failures happen before your user ever connects to your server. TCP timeouts, on shared infrastructure such as Content Delivery Networks (CDNs), are difficult to attribute to a specific origin. Even […]

Your most sensitive data—patient records, financial data, classified documents—lives in a private Amazon Virtual Private Cloud (Amazon VPC) with no internet access, and for good reason. That network isolation is a deliberate security posture, not an oversight. The problem is that your AI agents need to reason over that data, and traditional networking approaches force […]

Customers adopting AWS Network Firewall at scale have shared two consistent pieces of feedback. First, managing inspection for centralized deployments adds operational complexity. Second, deploying separate firewalls for each VPC in distributed deployments becomes costly and difficult to manage as the number of VPCs increases. In this post, we explore the architectural patterns for two […]

At re:Invent 2025 we launched AWS Network Firewall proxy in preview to gather feedback from customers before making it generally available. That feedback was clear and consistent: customers want the flexibility to use their Network Firewall, with all its existing capabilities, as an explicit proxy. Rather than managing a separate proxy product with its own security policy model, customers told us they would prefer […]

Centralized VPC inspection with Amazon VPC Route Server and AWS Transit Gateway helps you route traffic from multiple virtual private clouds (VPCs) through a shared firewall for security enforcement. Spoke VPCs send traffic through AWS Transit Gateway to a dedicated inspection VPC, where firewall appliances examine it before forwarding. The challenge is making this inspection […]

Domain governance in Amazon Route 53 can mean the difference between a routine account decommissioning and an unplanned outage. Picture this situation: your organization closes an Amazon Web Services (AWS) account, and five days later a customer-facing website becomes unreachable, email stops flowing, and SSL certificate validation fails. A domain that this account had registered […]